Problem: no fuzz testing for CURVE

Solution: add simple, initial tests for client and server

Makefile.am

@@ -1126,6 +1126,26 @@ tests_test_connect_null_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
 tests_test_connect_null_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
 tests_test_connect_null_fuzzer_CXXFLAGS = -std=c++11
 
+if HAVE_CURVE
+fuzzer_apps += tests/test_bind_curve_fuzzer \
+	tests/test_connect_curve_fuzzer
+
+tests_test_bind_curve_fuzzer_DEPENDENCIES = src/libzmq.la
+tests_test_bind_curve_fuzzer_SOURCES = tests/test_bind_curve_fuzzer.cpp
+tests_test_bind_curve_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
+		$(top_builddir)/src/.libs/libzmq.a \
+		${src_libzmq_la_LIBADD}
+tests_test_bind_curve_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+tests_test_bind_curve_fuzzer_CXXFLAGS = -std=c++11
+
+tests_test_connect_curve_fuzzer_DEPENDENCIES = src/libzmq.la
+tests_test_connect_curve_fuzzer_SOURCES = tests/test_connect_curve_fuzzer.cpp
+tests_test_connect_curve_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
+		$(top_builddir)/src/.libs/libzmq.a \
+		${src_libzmq_la_LIBADD}
+tests_test_connect_curve_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+tests_test_connect_curve_fuzzer_CXXFLAGS = -std=c++11
+
 FUZZINGdir = ${prefix}/${FUZZING_INSTALLDIR}
 FUZZING_PROGRAMS = ${fuzzer_apps}
 else
@@ -1139,6 +1159,18 @@ tests_test_bind_null_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
 tests_test_connect_null_fuzzer_SOURCES = tests/test_connect_null_fuzzer.cpp
 tests_test_connect_null_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
 tests_test_connect_null_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+
+if HAVE_CURVE
+test_apps += tests/test_bind_curve_fuzzer \
+	tests/test_connect_curve_fuzzer
+
+tests_test_bind_curve_fuzzer_SOURCES = tests/test_bind_curve_fuzzer.cpp
+tests_test_bind_curve_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
+tests_test_bind_curve_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+
+tests_test_connect_curve_fuzzer_SOURCES = tests/test_connect_curve_fuzzer.cpp
+tests_test_connect_curve_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
+tests_test_connect_curve_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
 endif
 
 if ENABLE_STATIC

tests/CMakeLists.txt

@@ -80,6 +80,9 @@ endif()
 
 if(ZMQ_HAVE_CURVE)
   list(APPEND tests test_security_curve)
+  if(NOT WIN32)
+    list(APPEND tests test_connect_curve_fuzzer test_bind_curve_fuzzer)
+  endif()
 endif()
 
 option(ENABLE_CAPSH "Run tests that require sudo and capsh (for cap_net_admin)" OFF)

tests/test_bind_curve_fuzzer.cpp

@@ -0,0 +1,82 @@
+/*
+    Copyright (c) 2020 Contributors as noted in the AUTHORS file
+
+    This file is part of libzmq, the ZeroMQ core engine in C++.
+
+    libzmq is free software; you can redistribute it and/or modify it under
+    the terms of the GNU Lesser General Public License (LGPL) as published
+    by the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    As a special exception, the Contributors give you permission to link
+    this library with independent modules to produce an executable,
+    regardless of the license terms of these independent modules, and to
+    copy and distribute the resulting executable under terms of your choice,
+    provided that you also meet, for each linked independent module, the
+    terms and conditions of the license of that module. An independent
+    module is a module which is not derived from or based on this library.
+    If you modify this library, you must extend this exception to your
+    version of the library.
+
+    libzmq is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+    FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
+    License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifdef ZMQ_USE_FUZZING_ENGINE
+#include <fuzzer/FuzzedDataProvider.h>
+#endif
+
+#include "testutil.hpp"
+#include "testutil_security.hpp"
+
+// Test that the ZMTP engine handles invalid handshake when binding
+// https://rfc.zeromq.org/spec/37/
+extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
+{
+    void *handler;
+    void *zap_thread;
+    void *server;
+    void *server_mon;
+    char my_endpoint[MAX_SOCKET_STRING];
+
+    setup_test_context ();
+    setup_testutil_security_curve ();
+    setup_context_and_server_side (&handler, &zap_thread, &server, &server_mon,
+                                   my_endpoint);
+    fd_t client = connect_socket (my_endpoint);
+
+    for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
+         size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
+        sent = send (client, (const char *) data, size, MSG_NOSIGNAL);
+    msleep (250);
+
+    close (client);
+
+    shutdown_context_and_server_side (zap_thread, server, server_mon, handler);
+    teardown_test_context ();
+
+    return 0;
+}
+
+#ifndef ZMQ_USE_FUZZING_ENGINE
+void test_bind_curve_fuzzer ()
+{
+    TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (
+      zmtp_greeting_curve, sizeof (zmtp_greeting_curve)));
+}
+
+int main (int argc, char **argv)
+{
+    setup_test_environment ();
+
+    UNITY_BEGIN ();
+    RUN_TEST (test_bind_curve_fuzzer);
+
+    return UNITY_END ();
+}
+#endif

tests/test_connect_curve_fuzzer.cpp

@@ -0,0 +1,85 @@
+/*
+    Copyright (c) 2020 Contributors as noted in the AUTHORS file
+
+    This file is part of libzmq, the ZeroMQ core engine in C++.
+
+    libzmq is free software; you can redistribute it and/or modify it under
+    the terms of the GNU Lesser General Public License (LGPL) as published
+    by the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    As a special exception, the Contributors give you permission to link
+    this library with independent modules to produce an executable,
+    regardless of the license terms of these independent modules, and to
+    copy and distribute the resulting executable under terms of your choice,
+    provided that you also meet, for each linked independent module, the
+    terms and conditions of the license of that module. An independent
+    module is a module which is not derived from or based on this library.
+    If you modify this library, you must extend this exception to your
+    version of the library.
+
+    libzmq is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+    FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
+    License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifdef ZMQ_USE_FUZZING_ENGINE
+#include <fuzzer/FuzzedDataProvider.h>
+#endif
+
+#include "testutil.hpp"
+#include "testutil_security.hpp"
+
+// Test that the ZMTP engine handles invalid handshake when connecting
+// https://rfc.zeromq.org/spec/37/
+extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
+{
+    setup_test_context ();
+    setup_testutil_security_curve ();
+    char my_endpoint[MAX_SOCKET_STRING];
+    fd_t server = bind_socket_resolve_port ("127.0.0.1", "0", my_endpoint);
+
+    curve_client_data_t curve_client_data = {
+      valid_server_public, valid_client_public, valid_client_secret};
+    void *client_mon;
+    void *client = create_and_connect_client (
+      my_endpoint, socket_config_curve_client, &curve_client_data, &client_mon);
+
+    fd_t server_accept =
+      TEST_ASSERT_SUCCESS_RAW_ERRNO (accept (server, NULL, NULL));
+    for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
+         size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
+        sent = send (server_accept, (const char *) data, size, MSG_NOSIGNAL);
+    msleep (250);
+
+    close (server_accept);
+    close (server);
+
+    test_context_socket_close_zero_linger (client);
+    test_context_socket_close_zero_linger (client_mon);
+    teardown_test_context ();
+
+    return 0;
+}
+
+#ifndef ZMQ_USE_FUZZING_ENGINE
+void test_connect_curve_fuzzer ()
+{
+    TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (
+      zmtp_greeting_curve, sizeof (zmtp_greeting_curve)));
+}
+
+int main (int argc, char **argv)
+{
+    setup_test_environment ();
+
+    UNITY_BEGIN ();
+    RUN_TEST (test_connect_curve_fuzzer);
+
+    return UNITY_END ();
+}
+#endif